{"id":82,"date":"2021-12-28T22:43:00","date_gmt":"2021-12-28T22:43:00","guid":{"rendered":"http:\/\/blog.firatyasar.com\/?p=82"},"modified":"2022-03-28T22:47:21","modified_gmt":"2022-03-28T22:47:21","slug":"scan-container-images-with-trivy","status":"publish","type":"post","link":"https:\/\/blog.firatyasar.com\/?p=82","title":{"rendered":"Scan Container Images with Trivy"},"content":{"rendered":"\n<p>Trivy ile scan i\u015flemine ge\u00e7meden \u00f6nce CVE(Common Vulnerabilities and Exposure) ne demek ona de\u011finelim. CVE&#8217;ler bilinen a\u00e7\u0131klar ve bunlar i\u00e7in al\u0131nmas\u0131 gereken \u00f6nlemleri i\u00e7erirler. Her CVE kendisine unique bir id al\u0131r. Her CVE ayr\u0131ca bir severity score&#8217;a sahiptir. Bu score 0 ile 10 aras\u0131nda bir de\u011ferdir. Bu score sayesinde bu a\u00e7\u0131klar\u0131 kapamak i\u00e7in yap\u0131lacak i\u015flemler \u00f6nceliklendirilebilir.<\/p>\n\n\n\n<p>\u00d6rnek olarak bir CVE \u00e7\u0131kt\u0131s\u0131 a\u015fa\u011f\u0131daki gibidir.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" width=\"1024\" height=\"537\" src=\"\/wp-content\/uploads\/2022\/03\/image-4-1024x537.png\" alt=\"\" class=\"wp-image-83\" srcset=\"\/wp-content\/uploads\/2022\/03\/image-4-1024x537.png 1024w, \/wp-content\/uploads\/2022\/03\/image-4-300x157.png 300w, \/wp-content\/uploads\/2022\/03\/image-4-768x403.png 768w, \/wp-content\/uploads\/2022\/03\/image-4-1536x805.png 1536w, \/wp-content\/uploads\/2022\/03\/image-4-660x346.png 660w, \/wp-content\/uploads\/2022\/03\/image-4-380x200.png 380w, \/wp-content\/uploads\/2022\/03\/image-4.png 1606w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Container mimarisinde bilinen bu a\u00e7\u0131klara kar\u015f\u0131 (CVE&#8217;s) tarama i\u015flemini yapan belirli tool&#8217;lar bulunuyor. Bunlardan birisi de Aqua Security taraf\u0131ndan yay\u0131nlanan Trivy.Trivy kullan\u0131m\u0131 \u00e7ok basit olan bir vulnerability scanner arac\u0131d\u0131r. Ayr\u0131ca CICD pipeline&#8217;lar\u0131na entegre edilmesi de olduk\u00e7a kolayd\u0131r. Trivy arac\u0131n\u0131n kurulumu da kullan\u0131m\u0131 gibi olduk\u00e7a kolayd\u0131r. Gerekli dependecyler kurulduktan sonra kolayl\u0131kla kullan\u0131labilir.<br><\/p>\n\n\n\n<p>A\u015fa\u011f\u0131daki komutlar\u0131 kullanarak trivy \u00fcr\u00fcn\u00fcn\u00fcn kurulumunu kolayl\u0131kla sa\u011flayabilirsiniz.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>apt-get  update\napt-get install wget apt-transport-https gnupg lsb-release\nwget -qO - https:\/\/aquasecurity.github.io\/trivy-repo\/deb\/public.key | sudo apt-key add -\necho deb https:\/\/aquasecurity.github.io\/trivy-repo\/deb $(lsb_release -sc) main | sudo tee -a \/etc\/apt\/sources.list.d\/trivy.list<\/code><\/pre>\n\n\n\n<p>Ard\u0131ndan repo&#8217;lar\u0131 update edip trivy&#8217;nin kurulumunu ba\u015flatal\u0131m.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>apt-get update\napt-get install trivy<\/code><\/pre>\n\n\n\n<p>\u0130\u015flemler tamamland\u0131ktan sonra a\u015fa\u011f\u0131daki komutlar yard\u0131m\u0131yla trivy kullanarak container imajlar\u0131n\u0131 tarayabilirsiniz.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>trivy image nginx:1.18.0<\/code><\/pre>\n\n\n\n<p>E\u011fer istenirse tarball olarak indirilen imajlar da taranabilir.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>trivy image --input alpine.tar --format json --output \/root\/alpine.json<\/code><\/pre>\n\n\n\n<p>Tarama i\u015flemi sonras\u0131nda \u00e7\u0131kt\u0131lar a\u015fa\u011f\u0131daki gibidir.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" width=\"1024\" height=\"446\" src=\"\/wp-content\/uploads\/2022\/03\/image-5-1024x446.png\" alt=\"\" class=\"wp-image-84\" srcset=\"\/wp-content\/uploads\/2022\/03\/image-5-1024x446.png 1024w, \/wp-content\/uploads\/2022\/03\/image-5-300x131.png 300w, \/wp-content\/uploads\/2022\/03\/image-5-768x335.png 768w, \/wp-content\/uploads\/2022\/03\/image-5-1536x670.png 1536w, \/wp-content\/uploads\/2022\/03\/image-5-660x288.png 660w, \/wp-content\/uploads\/2022\/03\/image-5.png 1748w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Trivy kullanarak imajlar\u0131,dosya sistemlerini ve git repo&#8217;lar\u0131n\u0131 kolayl\u0131kla tarayabilirsiniz.<\/p>\n\n\n\n<p>Trviy kullanma ile ilgili best practice&#8217;ler a\u015fa\u011f\u0131daki gibidir;<\/p>\n\n\n\n<ul><li>\u0130majlar\u0131n devaml\u0131 olarak taranmas\u0131 gerekir.<\/li><li>\u0130mage scan i\u015flemleri i\u00e7in Kubernetes admission controller&#8217;lar eklenmelidir.<\/li><li>Repostory&#8217;deki imajlar \u00f6nceden taranm\u0131\u015f olmal\u0131d\u0131r.<\/li><li>Scanning i\u015flemleri CICD pipeline&#8217;lar\u0131na entegre edilmelidir.<\/li><\/ul>\n\n\n\n<p>Temiz bir repository&#8217;e sahip olmak i\u00e7in imajlar\u0131n\u0131z\u0131 CICD a\u015famas\u0131nda taramay\u0131 unutmay\u0131n.<\/p>\n\n\n\n<p><\/p>\n\n\n\n<p>Kaynak: <a href=\"http:\/\/kodekloud.com\" data-type=\"URL\" data-id=\"kodekloud.com\">kodekloud.com<\/a><\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Trivy ile scan i\u015flemine ge\u00e7meden \u00f6nce CVE(Common Vulnerabilities and Exposure) ne demek ona de\u011finelim. CVE&#8217;ler bilinen a\u00e7\u0131klar ve bunlar i\u00e7in al\u0131nmas\u0131 gereken \u00f6nlemleri i\u00e7erirler. Her CVE kendisine unique bir id al\u0131r. Her CVE ayr\u0131ca bir severity score&#8217;a sahiptir. Bu score 0 ile 10 aras\u0131nda bir de\u011ferdir. Bu score sayesinde bu a\u00e7\u0131klar\u0131 kapamak i\u00e7in yap\u0131lacak i\u015flemler\u2026 <span class=\"read-more\"><a href=\"https:\/\/blog.firatyasar.com\/?p=82\">Read More &raquo;<\/a><\/span><\/p>\n","protected":false},"author":1,"featured_media":85,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[43,45,44,8,42],"_links":{"self":[{"href":"https:\/\/blog.firatyasar.com\/index.php?rest_route=\/wp\/v2\/posts\/82"}],"collection":[{"href":"https:\/\/blog.firatyasar.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.firatyasar.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.firatyasar.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.firatyasar.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=82"}],"version-history":[{"count":1,"href":"https:\/\/blog.firatyasar.com\/index.php?rest_route=\/wp\/v2\/posts\/82\/revisions"}],"predecessor-version":[{"id":86,"href":"https:\/\/blog.firatyasar.com\/index.php?rest_route=\/wp\/v2\/posts\/82\/revisions\/86"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.firatyasar.com\/index.php?rest_route=\/wp\/v2\/media\/85"}],"wp:attachment":[{"href":"https:\/\/blog.firatyasar.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=82"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.firatyasar.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=82"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.firatyasar.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=82"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}